PeruSBS Regulation on Information Security and Cybersecurity Management (Resolution 504-2021), Management System Duties
In force since .
A sector security regimes rule binding public and private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Security
As of .
What it requires
- This binds the companies in articles 16 and 17 of the General Law of the Financial System (banks, financial companies, municipal and rural savings and credit banks and others), private pension fund administrators, Banco de la Nación and, as article 1 and article 4 of Resolución SBS 504-2021 set out, the other companies the Resolution lists (reached by declaring that you provide financial services). Article 4 applies the general regime to the companies in article 4.2 and a simplified regime to those in article 4.3. The Resolution took effect on .
- Have your board approve the policies and guidelines of your information-security and cybersecurity management system (SGSI-C), assign the technical, personnel and financial resources it needs, and approve its organization, roles and responsibilities (article 5).
- Have your general management take the measures needed to implement the SGSI-C (article 6.1).
- Keep the SGSI-C proportionate to the size, nature and complexity of your operations (article 4.1).
- Make the arrangements needed to hold information that lets you act in time against cybersecurity threats and to treat vulnerabilities (article 16.1).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Superintendencia de Banca, Seguros y Administradoras Privadas de Fondos de Pensiones, which issued the Resolution under the powers of numerals 7 and 9 of article 349 of Law 26702.
Settledness
- As of
- Open questions
- Which later resolutions of the Superintendencia have amended the Regulation since its publication, and what penalty does the Superintendencia apply to a breach of it?
What this law does
Article 1.1 of the Regulation applies it to the companies named in articles 16 and 17 of the General Law of the Financial System and to the private pension fund administrators. Article 4.2 of the Regulation makes its general regime mandatory for banks and financial companies among others.
The general regime also covers pension fund administrators, card issuers, electronic-money issuers and Banco de la Nación. Article 5 of the Regulation makes the board responsible for approving and facilitating the actions required to have an appropriate information-security and cybersecurity management system.
Article 6.1 of the Regulation makes the general management of a covered company responsible for taking the measures needed to implement its information-security and cybersecurity management system. Article 4.1 of the Regulation requires the system to be proportionate to the size, nature and complexity of the company operations.
Article 16.1 of the Regulation requires a company to make the arrangements needed to hold information that lets it act in time against cybersecurity threats and to treat vulnerabilities. The Superintendencia issued the Resolution under the powers conferred by numerals 7 and 9 of article 349 of Law 26702. The Resolution is dated . The Resolution was published in the official gazette El Peruano on . The Resolution enters into force on , the date on which Circular G 140-2009 is repealed.
When LexLint raises it
When your app profile says your app provides financial services.